WIP: move secret token into environment